Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://wearedevs.com

windows11-21h2-x64

8

Resubmissions

08/08/2026, 17:37

260808-v7eaqav1ft7

08/08/2026, 17:33

260808-v4592a1gme6

08/08/2026, 17:23

260808-vyfgesvyht8

Analysis

  • user interaction
    yes
  • max time kernel
    417s
  • max time network
    419s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    08/08/2026, 17:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://wearedevs.com
  • Sample260808-vyfgesvyht
Score
8/10
adwaredefense_evasiondiscoveryspywaretrojanvmprotect

Malware Config

Signatures

  • Downloads MZ/PE file 3 IoCs
  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 7 IoCs
  • VMProtect packed file 4 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 17 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 24 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 11 IoCs
  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 42 IoCs
  • NTFS ADS 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wearedevs.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5132
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffe1657c188,0x7ffe1657c194,0x7ffe1657c1a0
      2⤵
        PID:1824
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11786040393372862280,3789469481762489698,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:5876
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,15888110502782903002,5850175150810196679,262144 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
        2⤵
          PID:5456
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,3305400874524819322,13965443481449816103,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=2928 /prefetch:13
          2⤵
            PID:988
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3324,i,11488580905694481097,2801747396918050516,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
            2⤵
              PID:1944
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3336,i,11829550311017058638,4299936081883639272,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
              2⤵
                PID:3932
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,4485399624134348088,3553504320290772596,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:14
                2⤵
                  PID:992
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,9179459909729992461,18131803932910968829,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                  2⤵
                    PID:5992
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,12107713737883088004,14981940002704970394,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4764
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                      cookie_exporter.exe --cookie-json=1128
                      3⤵
                        PID:4872
                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3390597921333901355,14952677317913348475,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
                      2⤵
                        PID:3448
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3390597921333901355,14952677317913348475,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
                        2⤵
                          PID:4964
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5780,i,17463345527590633483,15042766929407644502,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
                          2⤵
                            PID:3320
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5673558648380574031,2524189258810825124,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
                            2⤵
                              PID:560
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,18357404920528314604,1026172825316286918,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
                              2⤵
                                PID:4744
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3105808327031571292,18235245947502413042,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
                                2⤵
                                  PID:1132
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3952,i,13945756512459864598,6639605951146198865,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
                                  2⤵
                                    PID:3372
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3972,i,8768186942067488432,15347016320273576581,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:1
                                    2⤵
                                      PID:3868
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3876,i,10125973762430824750,5637844281646909166,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:1
                                      2⤵
                                        PID:3992
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6100,i,4514424325633099023,2525994809464938894,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:1
                                        2⤵
                                          PID:4576
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6528,i,16373405656492432328,10768627149892766075,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
                                          2⤵
                                            PID:5720
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6112,i,7080581629510913817,13391342235349092065,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
                                            2⤵
                                              PID:3616
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6564,i,18022729448502785467,9010275786135391540,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
                                              2⤵
                                                PID:4192
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7032,i,2874724374307953301,1262816681321877623,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
                                                2⤵
                                                  PID:5184
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,5472322385194494347,6933772587354688290,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
                                                  2⤵
                                                    PID:740
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7156,i,7226701437844839762,13436444097136611684,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
                                                    2⤵
                                                      PID:3600
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,6812539041308537549,9500588528930867881,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:14
                                                      2⤵
                                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                      • NTFS ADS
                                                      PID:5760
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7420,i,8674115776503624398,1740260375939372009,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
                                                      2⤵
                                                        PID:4316
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,2708624123731084098,17593370069230194285,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
                                                        2⤵
                                                          PID:4604
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7348,i,2708624123731084098,17593370069230194285,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
                                                          2⤵
                                                            PID:5768
                                                          • C:\Users\Admin\Downloads\pluto_nx.exe
                                                            "C:\Users\Admin\Downloads\pluto_nx.exe"
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2712
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7784,i,288287354228953301,8054934451413147992,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:14
                                                            2⤵
                                                              PID:4880
                                                            • C:\Users\Admin\Downloads\pluto_nx.exe
                                                              "C:\Users\Admin\Downloads\pluto_nx.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3332
                                                            • C:\Users\Admin\Downloads\pluto_nx.exe
                                                              "C:\Users\Admin\Downloads\pluto_nx.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              PID:3288
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7368,i,16198677897563463985,10688399130042312910,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
                                                              2⤵
                                                                PID:1812
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8228,i,14769268853171444215,11754464380467658251,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
                                                                2⤵
                                                                  PID:2072
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7680,i,7747580052105673957,3934289381134184587,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
                                                                  2⤵
                                                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                  • NTFS ADS
                                                                  PID:124
                                                                • C:\Users\Admin\Downloads\pluto.exe
                                                                  "C:\Users\Admin\Downloads\pluto.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Checks whether UAC is enabled
                                                                  • Suspicious use of FindShellTrayWindow
                                                                  PID:4596
                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4596.3428.15400578265603050540
                                                                    3⤵
                                                                    • Drops file in Windows directory
                                                                    • Enumerates system info in registry
                                                                    • Modifies data under HKEY_USERS
                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                    PID:4416
                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x168,0x16c,0x170,0x144,0x178,0x7ffe00dfb078,0x7ffe00dfb084,0x7ffe00dfb090
                                                                      4⤵
                                                                        PID:4972
                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1632 /prefetch:2
                                                                        4⤵
                                                                          PID:5012
                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
                                                                          4⤵
                                                                            PID:5136
                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2296,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
                                                                            4⤵
                                                                              PID:5232
                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                                                                              4⤵
                                                                                PID:1744
                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2200,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
                                                                                4⤵
                                                                                  PID:8152
                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4640 /prefetch:14
                                                                                  4⤵
                                                                                    PID:7436
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3416,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:10
                                                                                    4⤵
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:2868
                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4028,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:14
                                                                                    4⤵
                                                                                      PID:6308
                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=4432,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:1
                                                                                      4⤵
                                                                                        PID:4560
                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4792,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
                                                                                        4⤵
                                                                                          PID:8128
                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4036,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:14
                                                                                          4⤵
                                                                                            PID:3180
                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4944,i,7691990189771421711,12296050523599826207,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:14
                                                                                            4⤵
                                                                                              PID:6172
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/By4RWSAG7W
                                                                                            3⤵
                                                                                              PID:6136
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7004,i,14842431066365535829,2553152294834390532,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
                                                                                            2⤵
                                                                                              PID:764
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6556,i,4947506677045185885,4591247051158350047,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6048
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6648,i,7104944863421223575,12959850122675967854,262144 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:10
                                                                                                2⤵
                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                PID:5196
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8352,i,15564838870329388450,17104611392758971390,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:14
                                                                                                2⤵
                                                                                                • Modifies registry class
                                                                                                PID:6408
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8348,i,947285295327374549,5097762916987839172,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=8316 /prefetch:12
                                                                                                2⤵
                                                                                                  PID:6448
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,17294113269854963981,15543887917185498123,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=7444 /prefetch:14
                                                                                                  2⤵
                                                                                                    PID:7752
                                                                                                  • C:\Users\Admin\Downloads\pluto.exe
                                                                                                    "C:\Users\Admin\Downloads\pluto.exe"
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Checks whether UAC is enabled
                                                                                                    PID:6224
                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=pluto.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6224.7532.12735969805643478593
                                                                                                      3⤵
                                                                                                        PID:6796
                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x178,0x7ffe00dfb078,0x7ffe00dfb084,0x7ffe00dfb090
                                                                                                          4⤵
                                                                                                            PID:4056
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/By4RWSAG7W
                                                                                                          3⤵
                                                                                                            PID:3048
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7468,i,13359252707677700843,3196109009475991684,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=9048 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:8000
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8560,i,10937144882193698946,14113658541689967843,2097152 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:5224
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,14546728789758963401,18442823261654535040,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:14
                                                                                                              2⤵
                                                                                                                PID:4460
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,17789122932631346754,214089748788440358,524288 --field-trial-handle=2196,i,16799058516804808824,11496101478892394870,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
                                                                                                                2⤵
                                                                                                                  PID:2304
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                1⤵
                                                                                                                  PID:5476
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                  1⤵
                                                                                                                    PID:4344
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                    1⤵
                                                                                                                    • Enumerates system info in registry
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Modifies registry class
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                                    PID:6812
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe02aec728,0x7ffe02aec734,0x7ffe02aec740
                                                                                                                      2⤵
                                                                                                                        PID:6864
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,1971803023638746898,4829438412481719451,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2132 /prefetch:11
                                                                                                                        2⤵
                                                                                                                        • Downloads MZ/PE file
                                                                                                                        • System Time Discovery
                                                                                                                        PID:2760
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,17749303159606509247,9825145256422192745,262144 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2096 /prefetch:2
                                                                                                                        2⤵
                                                                                                                          PID:7072
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,10870119040333495428,368339206792599562,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2308 /prefetch:13
                                                                                                                          2⤵
                                                                                                                            PID:7128
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,13300709809756508991,17990289301510378711,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3460 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:1132
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,1758941992493659253,8105228918224768546,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3496 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:2932
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4344,i,1069041021569710424,8080168302593853759,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4352 /prefetch:9
                                                                                                                                2⤵
                                                                                                                                  PID:2524
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4776,i,11421431207028252989,5300710341920978791,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4780 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:6320
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5476,i,9605298542115323806,11229387847842546172,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5496 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:6480
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5700,i,13626760922001473335,1401037649058101348,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5704 /prefetch:14
                                                                                                                                      2⤵
                                                                                                                                        PID:5736
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,4336540849103994883,1775994814999677309,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5944 /prefetch:12
                                                                                                                                        2⤵
                                                                                                                                          PID:6500
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6060,i,7486860042196079235,13876319063971257105,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5796 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:2284
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6224,i,679321829100212045,9478944064893387604,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6272 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:1844
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,4559782682914365315,10509006440135796171,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6456 /prefetch:14
                                                                                                                                              2⤵
                                                                                                                                                PID:7596
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,13089079905854191969,6065180686426402593,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5700 /prefetch:14
                                                                                                                                                2⤵
                                                                                                                                                  PID:7604
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,15004811626850602833,870148260397413693,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6764 /prefetch:14
                                                                                                                                                  2⤵
                                                                                                                                                    PID:7612
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,17166766512626614216,16948818856106684802,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6708 /prefetch:14
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies registry class
                                                                                                                                                    PID:7900
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6560,i,10082795622888124416,8986441787220823307,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6528 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:7292
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6752,i,6993272965383614250,12090272937883026508,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4420 /prefetch:14
                                                                                                                                                      2⤵
                                                                                                                                                      • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                      • NTFS ADS
                                                                                                                                                      PID:7600
                                                                                                                                                    • C:\Users\Admin\Downloads\RobloxPlayerInstaller-BD9WWQ7CDC.exe
                                                                                                                                                      "C:\Users\Admin\Downloads\RobloxPlayerInstaller-BD9WWQ7CDC.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Checks whether UAC is enabled
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Modifies registry class
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:2524
                                                                                                                                                      • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                        "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken BD9WWQ7CDC --deeplink https://www.roblox.com/games/95082159892680/1-Speed-Keyboard-Escape-Candy-Chocolate --webBtid 1786209991590007 --downloadSource web_game_join --authenticationTicket s6-BFEw5BfDwflD1L8twDG4Gij86eqCbRalJ6nXPF4ILfh4ZEGShs5Xqg14UjdMC4iuRht2HQD7f58W2IgFhoA8gXJisiGVmeF9i6hTwz1Y_4IWm-n0HwNKAlFnzEDqTPg0XygfIauatNsIgcNw4-x_Gu-tqm_GpwvGR2MPj4OJJGonYqyPCwyRIPB_XBveiDsBJ6KForeBpEPZ6ggtT6HjuClP_aVkG9PI1sNSNZHKp3b1OGgmuQUx3MP66kvAKlbmbC53GDAvstazrPQmKm1ZQVaetlZjaYnu7LyhiFsde9kAN6TVYvgoacFvEO7aAYJLhE66KAKpPdVFl6GGuPkVIPV_DAmVjyoyFhbPS09GJrE6Fi_kVu7GGF1o86OIFsmfSe4ZyOnhpOc9ik8uIA_QlVC-NRLVWbGJFgQnvfA7JESJQe890AkToQ3xPUJcSTwl7_2vzFt2cc44859HhjFh2x_5fPQ6ZqxGt2iXuVkmesnMhQygdTezicQJaIS5R0rt1sFBjBelZBN3_JyAZKJbkpXzwPfxOVndwNvKucn4 -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 2524
                                                                                                                                                        3⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                        PID:2280
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4008,i,15174481223301407151,6765126166583102999,262144 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6712 /prefetch:10
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                      PID:7952
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=4904,i,16529919325690310271,5944439994680912270,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3476 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:748
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6420,i,5481440536723689611,82164428025135906,524288 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=6408 /prefetch:14
                                                                                                                                                        2⤵
                                                                                                                                                          PID:7612
                                                                                                                                                        • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                          "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:LJhoND4uVLcnWxcKmD-sA5YUHfltp6sB0TA2A2EyT3jxC-bdb6jOXu9dyPTwE85Vngn0xfx7V9APH8yyssnou786eSso6RZU48bz48mwBo-1R6p31GKL0S4o2NfejxzJIVGklGp1vnxbHsd5hhQyQX1mq3aDuvcvmZUTnaImn90wf81QTmeTW1IvjvlctzmahJydCfME69lQDJh0vl2KAw3vtaLOSReRcaqbGagtZl3GraPpkkip2AIUOOt4g5sG5oxMhYg1vT2Y6QWwChaluvKaCtkh6DoXtYsvrgjA_3Sv-aZF0K_fqegyrGhl0UiIQLAro8FDsIyZ2kcih41q_gJJ9dvdLSoOYBO1ekvsHSNKq09G1tnSz2zf4myjdcppi8CcY7jvVc42fKqPc7JmfQFlDrHlOO-dlNET81h8fZ28CT2SShnir4sCqo4RBCVqRiy7dFqGk1HNSfK-3lWBmSYsgdLOFBFzm2t3DuR00QBp6J1Kyyz3kchN_8AVH6rja7rr1rLqmq_aXm9-FhUK4i-5T7NpFcRsVnSo7gwCDeU+launchtime:1786210155044+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786209991590007%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D9f8a5dfd-347a-4c49-8bf3-4fd2af7c7cbf%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786209991590007+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                                                                                          2⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                          • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                          • System Time Discovery
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          PID:6264
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=3516,i,5533483632226298506,11139293458593062663,2097152 --field-trial-handle=2100,i,11037027390855940402,307181523810154547,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3556 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:7704
                                                                                                                                                          • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                            "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" roblox-player:1+launchmode:play+gameinfo:ZVl7iHIAwSEFw0BZtt8RHNzujF2tcjbb6itwxNx_rfvgVGQMu0xW9zpxk9z7JWiXz1Ng4sm_JLWd5T6OVXWxrJGrutQ0DOvxWsrs3lDTJ2TZd4ASEVRPfN5L5oGAcTmeP2JSqEy9Svlv6nY-5OU64quyYYSXe6QvVITBkirtJRgSB8zx7j7uhR4kPkXtiR8oLy04RuQ9sNJj5vreIidK5bonM4WTKM-HmdVxotNtkhOKfcLIlIbpWenJFvzKM-wNOT1Mvbo0SavzatoZsuQFXnrEj6OR8qWVmKkm6uLfsnTT9Cf93jsKEZwdHHTLM1t9SgBtSoGmOxM7gTu06UP44ABxvtG5hL2ajv939GpAr4v9yepHWe3pvqifWersY0gsyzUHA4xHsTFrg7Eg4j0Z4EiJW0kLLm--4D-1NVSemeRnlvX1yLqgUXKCybEvehDlE5Qx3BQ16PMh2UIWeyEs-u-8tcpYt5hVubDrhXfgNIUMHACZGtb_BBVduscGruO5Y9uoxC8T6-VjyErxObYUROBjqrBp1O6yqsN9OdiQIN0+launchtime:1786210171885+placelauncherurl:https%3A%2F%2Fwww.roblox.com%2FGame%2FPlaceLauncher.ashx%3Frequest%3DRequestGame%26browserTrackerId%3D1786209991590007%26placeId%3D95082159892680%26isPlayTogetherGame%3Dfalse%26referredByPlayerId%3D0%26joinAttemptId%3D74672c9d-340d-48e3-abb5-31b26afe4513%26joinAttemptOrigin%3DPlayButton+browsertrackerid:1786209991590007+robloxLocale:en_us+gameLocale:en_us+channel:+LaunchExp:InApp
                                                                                                                                                            2⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                            PID:7660
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                          1⤵
                                                                                                                                                            PID:6824
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe02aec728,0x7ffe02aec734,0x7ffe02aec740
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6852
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:5768
                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:6580
                                                                                                                                                                • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                                  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:3196
                                                                                                                                                                • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                                  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:7660
                                                                                                                                                                • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                                  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:1964
                                                                                                                                                                • C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe
                                                                                                                                                                  "C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                  • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:3868
                                                                                                                                                                • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                  "C:\Windows\system32\taskmgr.exe" /7
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Checks SCSI registry key(s)
                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                  PID:7136

                                                                                                                                                                Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      RobloxStudioInstaller.exe
                                                                                                                                                                      • Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
                                                                                                                                                                      • Size 9.7MB
                                                                                                                                                                      • SHA256 eea5136d2e39678414ffacd6b0cd17d827b94ca5e09e9468a07da262ccbf226b
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                                                      • Size 528B
                                                                                                                                                                      • SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      F28CC103A764A74B222272A7D2BDDA5C
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F28CC103A764A74B222272A7D2BDDA5C
                                                                                                                                                                      • Size 454B
                                                                                                                                                                      • SHA256 aa998c9d3e42f03a8fd8a7326e44816f52c9703f92229eb9a6c85918e557aa70
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                                                                                                                                                                      • Size 174B
                                                                                                                                                                      • SHA256 40ee11173030887162fb0f2d570f1f9d4a2aa335f55a01e6ee9b7a5da1483cf6
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                                                                                                                                                                      • Size 170B
                                                                                                                                                                      • SHA256 6fc8e80605f47c2b2cc7cc79169d6fbcf9e00c86413fc4ec66abba2ef36b4640
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      F28CC103A764A74B222272A7D2BDDA5C
                                                                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F28CC103A764A74B222272A7D2BDDA5C
                                                                                                                                                                      • Size 192B
                                                                                                                                                                      • SHA256 21331545d3ba859cd809fd8abb25be63771f43f5bae45f113718372befbbaa66
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      settings.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                      • Size 40B
                                                                                                                                                                      • SHA256 d65599d6ada1368cfdd37752f9f4ffa701a4bb9094fb2761a55cc5148f0c2ad4
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      BrowsingTopicsState
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                      • Size 414B
                                                                                                                                                                      • SHA256 3ed2ab811ba533845fa2f46f87c2a4355abe428c68a765d8a648c9cf2b947bc4
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      f_000007
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
                                                                                                                                                                      • Size 331KB
                                                                                                                                                                      • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      f_000137
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000137
                                                                                                                                                                      • Size 51KB
                                                                                                                                                                      • SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 5KB
                                                                                                                                                                      • SHA256 eb0be24b19e6b47f7cd3f8695f74558c59e0276752a652b2577ef8253990ab25
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      000003.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\000003.log
                                                                                                                                                                      • Size 101KB
                                                                                                                                                                      • SHA256 8b674c7430d7f37e2464e3c15c33ac6f2dfc61c373dee9dfb5fb0f570a3567eb
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      LOG
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\LOG
                                                                                                                                                                      • Size 512B
                                                                                                                                                                      • SHA256 d87dc560d6112f80475120d0ba35697f2d031c7bf55bfcf59834b7ed1a093db4
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                      • Size 23B
                                                                                                                                                                      • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                      • Size 13KB
                                                                                                                                                                      • SHA256 aa50216ed8d48b892fbaf52862a207785e79e518a99567c33d4c882a8fa8d349
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                      • Size 12KB
                                                                                                                                                                      • SHA256 917ead3fc958a4f75aad8ac0adda231256af0a64436bf641eb27fd91234c5eca
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 12KB
                                                                                                                                                                      • SHA256 542f40f3b904e463916dfc5d4ead2843d258ce6ae2ade964c0e9f5e8cc08fbbf
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 aeca8b44d2e4fd70cee3edafa2a4275c343c4ebdb94e2fd7937455d56877b558
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 d38a0d86ebe6a7a217484a77d2e53df8a2ddea02a773bdfe94746d91f25c5b3d
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 b6616f456f75d41df086c50d411d5d127020c6193e700c279e8480f8951437dd
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 13KB
                                                                                                                                                                      • SHA256 4eb9dd1d435daabfd3e2f2f04ecb4b1f6be24c811d307bb3cb2fd326a297dd97
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 0d27a0dee788dfb9af346236c6575a585cd76d8abbe9e80cc2d9cd12ee4b27a7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 7de7fb9dc38efd66fb3925f30d3cf7f7455636a61d8f13b199f1c300fa2d16fa
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                      • Size 13KB
                                                                                                                                                                      • SHA256 ed33a9657dfd54814340a62cd7b5f8e4e9fd900866d0223579660156d9c1a43a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Secure Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                      • Size 17KB
                                                                                                                                                                      • SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                      • Size 120B
                                                                                                                                                                      • SHA256 f85b18658a2998a368f8cbdef571ffed04fc09f2e7fab538086681afd83e09ff
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index~RFe5a6090.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6090.TMP
                                                                                                                                                                      • Size 96B
                                                                                                                                                                      • SHA256 cae60aceac983c96c102a4ec9106fa6cc7f99de79f7c3311b75e841166c0e18e
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                      • Size 72B
                                                                                                                                                                      • SHA256 70b42857e06b63f75961a4d448a45e2e4a4710266e5002d9b36f92585c2b6cca
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 236KB
                                                                                                                                                                      • SHA256 a843bf297029a4228857a360e579b3ee1e833463b35d704774ef55ca11f1dc9c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 115KB
                                                                                                                                                                      • SHA256 72b9dd59738fa59a8ca3bef3a80d6e0f026e478b0f207b2c8fdeb582add6022a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 235KB
                                                                                                                                                                      • SHA256 3c025c4740d386061d1cf027512e3d805f4480b65e001c8e542d90c0b32bdb4e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 236KB
                                                                                                                                                                      • SHA256 3b900a118b82604c507e7704597de4c8fe37667c0296d8d763235d7821664949
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 236KB
                                                                                                                                                                      • SHA256 c70d0e4f8b9bad8596ac728f09f2e80528f0b5968e9d0d8b7051f6aa819f0340
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                      • Size 235KB
                                                                                                                                                                      • SHA256 a831c87eaf49d0802823406b0f2e6c88b6039d2a3fb6fdb35b62febc76d7db52
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      settings.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                      • Size 280B
                                                                                                                                                                      • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      settings.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                      • Size 280B
                                                                                                                                                                      • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      LOG.old
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                      • Size 334B
                                                                                                                                                                      • SHA256 244bd4e55f8b3c5c4e67e9ec7360965ae457ad58f3988e59776ecc249f4bb206
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      BookmarkMergedSurfaceOrdering
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                      • Size 6B
                                                                                                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      BrowsingTopicsState
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                                      • Size 414B
                                                                                                                                                                      • SHA256 2c0e9e86399d12353917fb2bfb4e069d991f55386edd82ec1a7e57cfe5307435
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      f_0000b8
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b8
                                                                                                                                                                      • Size 44KB
                                                                                                                                                                      • SHA256 e2291e842cf5af167122a22881a740c7f2dda7716f1e8cd76680264f4a859470
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      f_0000bb
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb
                                                                                                                                                                      • Size 21KB
                                                                                                                                                                      • SHA256 cd5c3999d7d153b7b8e1a2effd1dd354ddebbf9c3974b8063e6429ef479c6972
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 09a9180fb3384cfb79441b3ec8c6d3b0981bd32185faeb65955fe8d8f6c6bfd3
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 8KB
                                                                                                                                                                      • SHA256 357e35c685e87a45d6ed75de8b8742e9feb0bc0b66598beb6ba0e1b26809e389
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 9KB
                                                                                                                                                                      • SHA256 8be8e596574cd1d2cddec5b02ba719bc8d9a190e61c2d19b7ca7d666b8772b24
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index~RFe58dc90.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dc90.TMP
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 1531d82f1e7e18ca463ae06ef395c3e1003d4a5a11896476695016493ec74c67
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SiteList-Enterprise.json
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                      • Size 2B
                                                                                                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                      • Size 16KB
                                                                                                                                                                      • SHA256 3b3f5eb9d095df77fce26b82defe6ea6e16aab29f9debd96108b771e4e1dbea7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 3cc585684e6e23f39f0547da9780dd86b76d6d428880213ac968e051e38e1094
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SCT Auditing Pending Reports
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                      • Size 2B
                                                                                                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Sdch Dictionaries
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                      • Size 40B
                                                                                                                                                                      • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      • Size 15KB
                                                                                                                                                                      • SHA256 515b3396e3ffe389b1ffa5a7519fb7bf6d5521315968292dd5a49dc13631183d
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      • Size 14KB
                                                                                                                                                                      • SHA256 fd6e209702bce04b840dfa3c5dccb12fdbe2d461609349f964af221075af2360
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      • Size 15KB
                                                                                                                                                                      • SHA256 9ed80caaec9a253661810b64e91956a710503f41c259bca321e852683d0d33ec
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      • Size 15KB
                                                                                                                                                                      • SHA256 80fd69492c12b4062a6717eb87c65acc90029433bfa3f36a74094b2c23df6762
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                      • Size 15KB
                                                                                                                                                                      • SHA256 f0103aeaed0d6c829ba617e22977114143a76515f64b868d4e08d86403e37e2e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Secure Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                      • Size 31KB
                                                                                                                                                                      • SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eb07318f-f906-4ddf-9589-be7724191686\index-dir\the-real-index
                                                                                                                                                                      • Size 72B
                                                                                                                                                                      • SHA256 60be02a5c47c98aa50952d77fe5c44fc7f9d9034595a85bc5368f5f9ff8b93e9
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index~RFe5c55a9.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eb07318f-f906-4ddf-9589-be7724191686\index-dir\the-real-index~RFe5c55a9.TMP
                                                                                                                                                                      • Size 72B
                                                                                                                                                                      • SHA256 7afadf866c6b21f9d11e9aac149260ed3a5535951d3d52217887bd2f4bd2a931
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      index.txt
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                      • Size 476B
                                                                                                                                                                      • SHA256 763908c34b065f8d7a01bc6de8eef27127e7ec0a606019a243a5feea29256eef
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\e03fcb7b-fbd8-4556-ac14-fab8b2deb48e\index
                                                                                                                                                                      • Size 24B
                                                                                                                                                                      • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      index.txt
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                      • Size 233B
                                                                                                                                                                      • SHA256 5654ee5457d600ebfe78e09759668327dbfab0b79cf800b68b2985908b72abe9
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      index.txt
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                                                                                                      • Size 226B
                                                                                                                                                                      • SHA256 0769a7e1608a1de15538ea261d59d2ae70cb97f7f1f021b55c7300ff32ef9cf0
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      index.txt~RFe599baa.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe599baa.TMP
                                                                                                                                                                      • Size 138B
                                                                                                                                                                      • SHA256 12bb451e8e3a2a66e79aa2823e4da1d57353ae6c8b60a1aa6f5a76c81555aad4
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                      • Size 96B
                                                                                                                                                                      • SHA256 3e196318a3c52a54614d0651057495d8f7fdfb863c68b896a6020ceaac8eded5
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      sync_diagnostic.log
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                      • Size 22KB
                                                                                                                                                                      • SHA256 0e9ffb1d8c15f82be5a80c5e36330f2b8790e8fd040368be14ad51ec7b53aca7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CURRENT
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                                                                                                                      • Size 16B
                                                                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      MANIFEST-000001
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                                                                                                                      • Size 41B
                                                                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 26KB
                                                                                                                                                                      • SHA256 6cc8ee302dd89bebe5aac2db402cb6ae572658d9542cef1e75114b722e940e60
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 25KB
                                                                                                                                                                      • SHA256 bf8a08bcf255cdb7a48abe96a26160fdb02df22b1e2aa6dea63564d6c69cf495
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 28KB
                                                                                                                                                                      • SHA256 5b7d2f6d642d8528f0c93c1335bcb1134ca1da03d05b4f61f21a597434df8fac
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 25KB
                                                                                                                                                                      • SHA256 e224007ae625e484eb393e0b7e81d8890ddcf75d0db2ce96761f61c2fcd3ff32
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 33KB
                                                                                                                                                                      • SHA256 578b03f2569b94f21a6b800384f4064a0ecad870161f84ae692ef1fa3ba7de48
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 28KB
                                                                                                                                                                      • SHA256 89fea51005d593bd0ff1c270097edde242642b8681ced0edf0402e732184c3d9
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 33KB
                                                                                                                                                                      • SHA256 6fa65cf6978047912d3fe5a8ab1d1dbf0f4e9f38b7a5e3fb562cb27de612a30b
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 33KB
                                                                                                                                                                      • SHA256 b4515fc4dd804cefd13247c3cd3295450406bcb1a64abc822499e1b3458aa243
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 33KB
                                                                                                                                                                      • SHA256 bee5b79341d0836c469df24524a3587f5581eb2718855d8b827fe0f2cba1aaec
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                      • Size 33KB
                                                                                                                                                                      • SHA256 a4c7dba158611b2c87fffbe5a5d51b223c06f57d93c84923dec4e3e8c02c2a64
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                      • Size 392B
                                                                                                                                                                      • SHA256 2e245ada609c78974ea11d90868203758873f38a3997700ad818b5400e507cdd
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      RevisitationBloomfilter
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                      • Size 392B
                                                                                                                                                                      • SHA256 91b921551b14975eb64ccfd64640460c8dd11721f5ed9b772b7abd4cb2113c27
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      RevisitationBloomfilter~RFe5897a7.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5897a7.TMP
                                                                                                                                                                      • Size 392B
                                                                                                                                                                      • SHA256 3e057a6ba080996bbf94bb53ca841ac876d3924d3daa47a734705330daae11db
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      d444176101c29a0b4a4edaee7215443a
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\d444176101c29a0b4a4edaee7215443a
                                                                                                                                                                      • Size 13.0MB
                                                                                                                                                                      • SHA256 d527cd3c5d7506571d5d6902cbf90015f05574a57d611b616052877957bcd659
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      protocols.json
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      crl-set
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                                                                                                                                                                      • Size 22KB
                                                                                                                                                                      • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      settings.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
                                                                                                                                                                      • Size 280B
                                                                                                                                                                      • SHA256 ada618127f8d14f0da6489fd0a5a570b525674b59d31c81582de8f7b4a6b7341
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      settings.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\settings.dat
                                                                                                                                                                      • Size 280B
                                                                                                                                                                      • SHA256 f9f104729cec8eea82723e15bd78a4421179ee6c1f14ed60f0fc8665c5397f64
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      throttle_store.dat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                      • Size 20B
                                                                                                                                                                      • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 408B
                                                                                                                                                                      • SHA256 4eb3b4473a32fc385b6f49c06c71cc2d2d6a21d12101ab9fb9673d36fecba249
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                      • Size 312B
                                                                                                                                                                      • SHA256 d8efb9f3c7e8d05b31ed04289dc042db891929b869a349105057619ead0b199a
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      the-real-index~RFe59e1cb.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e1cb.TMP
                                                                                                                                                                      • Size 48B
                                                                                                                                                                      • SHA256 179b494ddcd67d7bb32ff4d4d315727ff47eb2fda149f19555aa83c9ea6060d4
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      data_0
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\DawnWebGPUCache\data_0
                                                                                                                                                                      • Size 8KB
                                                                                                                                                                      • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      data_1
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\DawnWebGPUCache\data_1
                                                                                                                                                                      • Size 264KB
                                                                                                                                                                      • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      data_2
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\DawnWebGPUCache\data_2
                                                                                                                                                                      • Size 8KB
                                                                                                                                                                      • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      data_3
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\DawnWebGPUCache\data_3
                                                                                                                                                                      • Size 8KB
                                                                                                                                                                      • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 ea0c1c3a4b3984f9d1064d32e0e08bdbc73b6394f00f4c74bcc1d6eca7ba6aa6
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Network Persistent State~RFe5aa0b6.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\Network Persistent State~RFe5aa0b6.TMP
                                                                                                                                                                      • Size 59B
                                                                                                                                                                      • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TransportSecurity
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                      • Size 849B
                                                                                                                                                                      • SHA256 391191dda7baaf3985f0c8707e998d75623e406ff67c61429e1334deb4027d02
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TransportSecurity
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                      • Size 853B
                                                                                                                                                                      • SHA256 db25a6a0d4f6f10fe09a4f575154d4cdb5594c6b4341b53b389aa4725a67cc16
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TransportSecurity~RFe59dcd9.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Network\TransportSecurity~RFe59dcd9.TMP
                                                                                                                                                                      • Size 849B
                                                                                                                                                                      • SHA256 b281f87d6c7374ef96cd6cc33438ec5c0391cc2ad92bf89d52eb1dd81a79a78a
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
                                                                                                                                                                      • Size 7KB
                                                                                                                                                                      • SHA256 4318b9e9212fcdea25279ebf7d0dee706a02582bbff0e455e37f7d3921062298
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
                                                                                                                                                                      • Size 6KB
                                                                                                                                                                      • SHA256 c520d588664e02efb7426d8e623d824571143b1c9ddf06a32fa5f844f1275575
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
                                                                                                                                                                      • Size 6KB
                                                                                                                                                                      • SHA256 ee389f435f2d43394a2d4ad39ee23d804133aba22970a2c2d5c01ce3b56a9828
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences
                                                                                                                                                                      • Size 6KB
                                                                                                                                                                      • SHA256 164c4e7fe972a2653c296b504b2f04dc768586dd2b611967b365c7b6421563d4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Preferences~RFe59dc4d.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Default\Preferences~RFe59dc4d.TMP
                                                                                                                                                                      • Size 6KB
                                                                                                                                                                      • SHA256 c33f6589297ea96df818063ba947e7be3fff2431950142a82da3d89a7a7a0ed7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 16KB
                                                                                                                                                                      • SHA256 510f044fbba95c19703e0610bb62f2ef7b36ace3d0746427ebdb823b88d33c6f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 18KB
                                                                                                                                                                      • SHA256 4f39b0553c6861c3ff4735fd87a4f8e9714ec2467898c4d00f7d0d574faa4c26
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 16KB
                                                                                                                                                                      • SHA256 5db76589b45a4b5dcd5c51da77e3e6851a6bfe2fa9e9b9c9c261ac665679b1ea
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 aafccf13b2e7974d2dff2cbf9c5317c2971053b081c2f08bc1e1fdce441bdf0b
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 d3b6d698809c9e4f8c15b2936b2c3689c246874004494f5801a7f065767894a9
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 3b665514cf540e8491d47b13e3c04a12dc9df5af3bda39734c5958a6b265510f
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 0ae5b895584ef97c53b07e8cce5504e8b69c5dc9179f709faafdb63e352896f4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Local State~RFe59869b.TMP
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Local State~RFe59869b.TMP
                                                                                                                                                                      • Size 1KB
                                                                                                                                                                      • SHA256 68dab018d9974b2b663b6f823c29d10ac3467e1b61192e03c2b0314c22e5ea07
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      Filtering Rules
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\Filtering Rules
                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                      • SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      LICENSE
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\com.vrad.pluto\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\LICENSE
                                                                                                                                                                      • Size 24KB
                                                                                                                                                                      • SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 02f60b32e8290241279f31c14a8dd032446ac8d08e6a1c26360532c43cd934bd
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2a2e0412b8ad04a2.customDestinations-ms
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 aa3e429b15fd8015f5c7e0b4f9608427cde41bee0153b657f437e520606cfc80
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      pluto.exe
                                                                                                                                                                      • Path C:\Users\Admin\Downloads\pluto.exe
                                                                                                                                                                      • Size 15.7MB
                                                                                                                                                                      • SHA256 f06e8684052fe924c9d289f3d6f0e86f0dcbb7f8548a3b270e341ac06b3186ff
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      pluto.exe:Zone.Identifier
                                                                                                                                                                      • Path C:\Users\Admin\Downloads\pluto.exe:Zone.Identifier
                                                                                                                                                                      • Size 26B
                                                                                                                                                                      • SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      pluto_nx.exe.crdownload
                                                                                                                                                                      • Path C:\Users\Admin\Downloads\pluto_nx.exe.crdownload
                                                                                                                                                                      • Size 7.9MB
                                                                                                                                                                      • SHA256 9bc805b7fbf8374d721318b8ec9a540e58c4c43b10df4c34b3f076bf929bc6b4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      pluto_nx.exe:Zone.Identifier
                                                                                                                                                                      • Path C:\Users\Admin\Downloads\pluto_nx.exe:Zone.Identifier
                                                                                                                                                                      • Size 89B
                                                                                                                                                                      • SHA256 f97421679eb6ccdbc26bd9f470d03c46bd85a66fd9155b65b394b7119f947fa6
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1167830092\manifest.json
                                                                                                                                                                      • Size 76B
                                                                                                                                                                      • SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      hyph-as.hyb
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1221101251\hyph-as.hyb
                                                                                                                                                                      • Size 703B
                                                                                                                                                                      • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      hyph-hi.hyb
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1221101251\hyph-hi.hyb
                                                                                                                                                                      • Size 687B
                                                                                                                                                                      • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      hyph-nb.hyb
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1221101251\hyph-nb.hyb
                                                                                                                                                                      • Size 141KB
                                                                                                                                                                      • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1221101251\manifest.json
                                                                                                                                                                      • Size 82B
                                                                                                                                                                      • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_1396764105\manifest.json
                                                                                                                                                                      • Size 43B
                                                                                                                                                                      • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_199523907\manifest.json
                                                                                                                                                                      • Size 116B
                                                                                                                                                                      • SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_2024531186\manifest.json
                                                                                                                                                                      • Size 113B
                                                                                                                                                                      • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.fingerprint
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_309262407\manifest.fingerprint
                                                                                                                                                                      • Size 66B
                                                                                                                                                                      • SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      manifest.json
                                                                                                                                                                      • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4416_309262407\manifest.json
                                                                                                                                                                      • Size 135B
                                                                                                                                                                      • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                      Submit Download

                                                                                                                                                                      memory/1744-786-0x00007FFE369C0000-0x00007FFE369C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2712-515-0x00007FFE375A0000-0x00007FFE375A2000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2712-516-0x0000000140000000-0x0000000140F31000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2712-514-0x00007FFE37590000-0x00007FFE37592000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3058-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3063-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3062-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3064-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3053-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3061-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3052-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3051-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3059-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2868-3060-0x000001D0825C0000-0x000001D0825C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3288-604-0x0000000140000000-0x0000000140F31000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3332-582-0x0000000140000000-0x0000000140F31000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4964-191-0x000002BE80000000-0x000002BE81000000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5012-675-0x00007FFE369C0000-0x00007FFE369C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/5768-532-0x000001C409FA0000-0x000001C40AFA0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4038-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4044-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4045-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4046-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4049-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4047-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4048-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4039-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/7136-4040-0x000002008E9C0000-0x000002008E9C1000-memory.dmp
                                                                                                                                                                      Download